1. COSO’s New ERM Exposure Draft: What You Should Know
Paul Sobel, CIA, QIAL, CRMA
Vice President and CAE, Georgia-Pacific
COSO Advisory Council member

2. COSO’s Fundamental Principle
Mission
COSO’s Mission is “To provide thought leadership through the development of comprehensive frameworks and guidance on enterprise risk management, internal control and fraud deterrence designed to improve organizational performance and governance and to reduce the extent of fraud in organizations.”
COSO’s Fundamental Principle
Good risk management and internal control are necessary for long term success of all organizations

3. Why Update the Framework Now?
Concepts and practices have evolved
Lessons learned
Bar raised with respect to enterprise risk management
Business and operating environments more complex, technologically driven, and global in scale
Stakeholders more engaged, seeking greater transparency and accountability
Risk discussions increasingly prominent at the board level

4. SEC Proxy Requirement…
Provide Information About Board Leadership Structure and the Board's Role in Risk Oversight:
The SEC approved rules relating to board leadership structure and the board's role in risk oversight. The rules require disclosure about:
A company's board leadership structure, including whether the company has combined or separated the chief executive officer and chairman position, and why the company believes its structure is the most appropriate for the company at the time of the filing.
In certain circumstances, whether and why a company has a lead independent director and the specific role of such director.
The extent of the board's role in the risk oversight of the company.

5. Project Governance Advisory Council and Observers:
COSO Board
PwC Project Team
Advisory Council
Observers
Advisory Council and Observers:
Consists of over 25 professionals
Provides input, expertise, feedback, insight, and ideas throughout the update.
Obtains and synthesizes feedback from their respective constituency, organization, industry

6. Advisory Council Official Observers CRO’s FDIC Risk Luminaries OIG
Risk Management, ERM University Professors
Chief Audit Executives
Accounting Firm Risk Practice Partners
Board Members
Public Sector
Company Executives
FDIC
OIG
GAO
IMA
IFAC
RIMS
ISACA
China Ministry of Finance (Special)
SEC - declined
PCAOB determined to not be relevant given no audit requirements

7. Framework Update Approach1 2 3 4 5
Assess
Envision
Design and Build
Public Exposure Process
Finalize

8. Foundational Concepts of ERM
Every entity exists to provide value for its stakeholders
All entities face uncertainty
Uncertainty presents both risk and opportunity
The challenge for management is to determine how much uncertainty to accept as it strives to grow stakeholder value
ERM enables management to effectively manage uncertainty and associated risk and opportunity

9. Topics Included in the 2004 COSO ERM Framework…
Aligning Risk Appetite and Strategy
Enhancing Risk Response Decisions
Reducing Operational Surprises and Losses
Identifying and Managing Multiple and Cross-enterprise Risks
Seizing Opportunities
Improving Deployment of Capital

10. What is your ideal view of ERM?
Baked in, embedded, not a bolt-on
Accelerates growth and success
Improves decision making and performance
Discipline, not a process
Ability to take on more risk
Continuous, identifiable, structured

11. What are Three Strengths of the 2004 Framework?
Linking risk to strategy setting
Linkage to objectives
Discussion of risk responses
Linkage to internal control
Evaluation/attestation criteria concept
Discussion of board governance and oversight
Due process

12. What are Three Significant Areas for Update and Revision?
Update principles
Revise definitions of risk, ERM and other key terms
Improve its usefulness
Consider introducing maturity models
Review format, structure, length, complexity
Emphasize the opportunity side of risk

13. What Should the Framework Do to Stay Relevant for the Next 10 years?
Include maturity models
Highlight sustainability
Focus on governance
Review principles
Stay a framework
Add update materials, papers

14. What Would Improve User Acceptance?
Increased CEO and board engagement and buy-in
Inclusion of case studies and examples of success
Clearer value proposition
Greater and more effective promotion
Alignment to relevant regulatory requirements

15. What’s Likely to Stay the Same…
Link to strategy and objectives
An activity involving many people – board, management and others
Ability to cascade down to subsidiary, division, function, etc.
Risk identification, assessment, prioritization and response
Control activities as a possible response, link to internal control
An ability to assess effectiveness
Monitoring to ensure effectiveness and value of efforts
A definitive body of knowledge and thought leadership

16. What Might Be New… Risk governance and culture concepts
Emphasis on integration into decision-making
Integration with performance management
Revised definitions and vocabulary – including uncertainly concept
More focus on using and leveraging information
More emphasis on value creation, preservation and realization
Mission, vision and values discussion
Many more examples including reporting examples
Introduction of risk curves

17. Components and Principles Structure
COSO 2013 Internal Control Framework

18. Possible COSO ERM Components
Risk Governance and Culture
Risk, Strategy and Objective Setting
Risk in Execution
Risk Information, Communication and Reporting
Monitoring Enterprise Risk Management Performance

19. Currently, ERM is Defined as….
“A process effected by an entity’s board of directors, management and other personnel, applied in a strategic setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives.”

20. Potential New Definition …
“The culture, capabilities and practices, integrated with strategy-setting and its execution, that organizations rely on to manage risk in creating, preserving and realizing value.”

21. And Maybe- A New Graphic!

22. Bridging Between ERM and Internal Control Frameworks

23. Incrementalism…
“How would you like to meet more of your objectives more of the time? “

24. Respond to the exposure draft!!!
Some Key Take-Aways
Everyone is doing ERM – can you do it better?
You need the right Tone at the Top
Analyze, understand and communicate your strategy better
Tie it in to decision-making and performance, cascade it down
Stay attuned to what’s on the horizon (emerging risks, change)
Leverage information
Keep it moving – it’s a journey
Make it happens all the time – it’s part of all decision-making
Respond to the exposure draft!!!

25. Thank You